Netatalk 1.5.0 through 4.4.2 contains a flaw where failures of seteuid calls within authentication modules are ignored. The failure to handle the return value allows a process to retain elevated privileges after authentication when it should have dropped to a lower privilege level. This vulnerability, classified as CWE-273, can be leveraged by a remote authenticated attacker to keep higher privileges than intended. The impact is a privilege escalation that enables the attacker to perform any action allowed to the privileged owner of the Netatalk daemon, but it does not provide arbitrary code execution.

Systems running Netatalk versions 1.5.0, 1.5.1, 2.x, 3.x, 4.0 through 4.4.2 on Unix-like platforms are affected. The flaw resides in the authentication modules shipped with these releases and is not mitigated by earlier or later releases according to the available CVE data.

The CVSS score of 4.0 indicates medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a relatively low probability of widespread exploitation. The likely attack vector involves a remote authenticated user who triggers authentication logic over Netatalk’s network protocols (AppleTalk, SMB, NFS). Successful exploitation would require valid authentication or a separate flaw in the authentication mechanism, which limits the overall likelihood compared to higher‑impact vulnerabilities.